Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Why is there a failure error when integrating splunk SH cluster with Indexing Cluster?

0

We have 3 node indexer Cluster and have setup a 3 node Search Head(SH) cluster. We are trying to integrate the SH cluster with the index cluster. I'm running the following command:./splunk edit cluster-config -mode searchhead -master_uri https://master:8089 -secret

I run this on each SH cluster member and they all give the following response:Could not contact master. Check that the master is up, the master_uri=https://master:8089 and secret are specified correctly

I've confirmed that everything is correct. I tested with curl and telnet to make sure the master could be reached on 8089 from each SH. The search head cluster is up and running as is the indexer cluster. I've attempted to change master to fqdn and IP address.

Does anyone have any other suggestions? This seems like such an easy fix but it's been driving me crazy for 2 days.

People who like this

I found a post online from someone that submitted their server.conf. I noticed on our searchheads, each server.conf file had mode=disabled whereas the poster had mode=searchhead. I changed that on each of my searchheads and now I am able to query the index cluster, but I'm not getting the same amount of data the stand alone search head sees (It's looking at the same indexer cluster)

Sorry, yes - I accidentally left that of my post but I am adding the password after secret

As an update, I went into server.conf on each SH cluster member and changed mode=disabled to mode=searchhead. I imagine that is what the command is supposed to do but it didn't work

After doing so I was able to get the SH cluster integrated with the indexer cluster. I went back to run that command and this time it was successful, or so it said. Of course all was working so not sure if it actually did anything, but at least the command execution didn't error out. Wonder if others have had issues with this command

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.